Teaching objectives
A university-level lab (first years) or advanced upper-secondary lab, about the curve y² = x³ + ax + b. It is very visual: almost everything happens by dragging points on the curve and watching how the line through them moves.
The central idea is easy to state and rich in consequences: a line meets a cubic in three points, and if two of them are rational, the third one is rational too. That rule, together with a reflection, turns the rational points of the curve into a group: they can be added, multiplied by an integer (n·P) and classified. From there come the hunt for rational points (Mordell: all of them are generated from a few) and torsion, the points that come back to the identity (Mazur: there are only 15 possible shapes). The lab leads into cryptography: the same curve, but with modular arithmetic (modulo a prime p), where computing n·P is fast and recovering n from n·P is, in practice, unmanageable. That asymmetry is what protects secure connections (TLS), WhatsApp or Bitcoin today.
What is learnt
- Seeing the curve y² = x³ + ax + b as a shape that changes with a and b (one or two pieces), and recognising when it stops being an elliptic curve (the discriminant 4a³ + 27b² vanishes).
- Defining the sum of two points with a chord and a reflection, and of a point with itself with a tangent; deriving and applying the addition formulas.
- Checking experimentally that this addition is associative and commutative, i.e. that the rational points of the curve form a group, with the point at infinity O as identity.
- Multiplying a point by a large integer with “double and add” (fast exponentiation), instead of adding one by one.
- Hunting rational points of a curve by height (denominator) and expressing them as a combination of a few generators (Mordell’s theorem).
- Recognising torsion (points of finite order) with the Nagell–Lutz criterion, walking through families of curves with fixed torsion (Tate normal form), and knowing the 15 possible torsion groups over the rationals (Mazur’s theorem).
- Moving the same arithmetic to modulo a prime p and understanding why multiplying a point is fast but undoing the multiplication (the discrete logarithm) is so costly, ending with a live Diffie–Hellman key exchange over an elliptic curve.
Key mathematical ideas, by block
A · The curve. The shape of y² = x³ + ax + b depends on the real roots of x³ + ax + b: two pieces if there are three real roots, one if there is a single one. The curve is singular (a node or a cusp) exactly when 4a³ + 27b² = 0; there it stops being elliptic. A line meets the cubic in three points, counted with multiplicity, or in two plus “one at infinity” if it is vertical.
B · Addition and multiplication. If P * Q were the sum, there would be no identity element; that is why P + Q is defined as the reflection of P * Q. With this definition, P + (−P) = O and P + O = P. Associativity, (P + Q) + R = P + (Q + R), is checked by dragging points and always holds, even though it is far from obvious (it actually rests on the nine points of Cayley–Bacharach). Multiplying by n with double and add costs on the order of log₂ n operations instead of n: 13·P takes 5 operations (double, add, double, double, add), not 12.
C · Hunting rational points. With rational coefficients, the chord and the tangent never leave Q: starting from rational points, only rational points are reached. Mordell’s theorem says the group of rational points is E(Q) ≅ T ⊕ Zʳ: finitely generated, with a torsion part T and a rank r of generators of infinite order. The size (the height, measured in digits of the denominator) of n·P grows like n², which makes a naive search unworkable for large n. Congruent numbers (areas of rational right triangles) are a classic example of this hunt: n is congruent if and only if y² = x³ − n²x has a point with y ≠ 0.
D · Torsion. Points of finite order (that return to O under multiplication) have integer coordinates and satisfy the Nagell–Lutz criterion (y = 0 or y² divides 4a³ + 27b²), which makes them findable with a finite table of candidates. Tate families show curves that deform under a parameter without breaking a closed torsion polygon. Mazur’s theorem (1977) closes the classification: over Q there are only 15 possible torsion groups, Z/n (n = 1…10, 12) and Z/2 × Z/2m (m = 1…4).
E · Cryptography: the way back. The same arithmetic, now modulo a prime p (a finite group): multiplication n·P still costs little, on the order of 2k operations for a k-bit key. Undoing it — given Q = n·G, finding n — is a different kind of problem depending on where it is posed:
- Over Q, the height gives n away: since the size of n·P grows like n², the size of Q almost tells you how big n is.
- Modulo p there are no clues: the orbit of G jumps around the grid with no pattern of closeness; being “close” to Q says nothing about n being close. By brute force, finding n costs on the order of 2^k steps, against 2k for the way there: a straight line against an exponential.
- The best known attack (baby-step giant-step, or Pollard’s ρ) brings N steps down to √N. With a 256-bit key, that is √(2²⁵⁶) = 2¹²⁸ steps, on the order of 10²² years at a billion steps per second — longer than the age of the universe. A sufficiently large quantum computer (running Shor’s algorithm) would break this problem; hence the interest in post-quantum cryptography.
The room “Hide and seek” goes through that asymmetry by playing before putting numbers on it: over Q the hidden number is guessed because the height gives it away; in the cloud of points modulo p, two neighbouring points can be very different multiples and two consecutive multiples land in opposite corners; and when the student hides their own n, the engine computes n·G in a few dozen operations and needs hundreds to recover it by brute force, with a toy prime. The room ends with the table comparing the way there with the way back.
That asymmetry, “cheap way there, hugely expensive way back”, is exactly what Diffie–Hellman uses: two people publish a·G and b·G and both compute the same ab·G without an observer being able to recover a or b.
F · Closing. A curve detective (a random curve from a checked list, whose torsion and, if there is one, a point of infinite order must be found) and a curve calculator with no tasks, with exact arithmetic and a view modulo p, which stays open for further exploring.
Credits
The lab closely follows Rational Points on Elliptic Curves by J. H. Silverman and J. Tate. The historical motivation starts from Bachet’s problem (1621) and Diophantus (rational points on a cubic). It relies on Mordell’s theorem (finite generation of the group of rational points), the Nagell–Lutz criterion, the Tate normal form for families with fixed torsion, and Mazur’s theorem (1977) on the 15 possible torsion groups. The cryptography block is based on the Diffie–Hellman key exchange and on elliptic-curve cryptography, proposed independently by N. Koblitz and V. Miller (1985).
Classroom notes
- “The third point” and “Adding means reflecting” are best seen back to back and projected: this is the moment when addition stops being a formula and becomes a picture that can be predicted.
- “An addition you can regroup” works better if the class is asked to predict the result before releasing the points: the surprise that it always matches is what carries the idea of a group.
- “Digits that explode” (the parabola of denominator digits) shows at a glance why brute-force searching for large rational points does not work.
- “Families with torsion” shows that the same torsion polygon survives even as the curve deforms with the slider u.
- “Hide and seek” is the key room of the cryptography block: the game makes the asymmetry felt before it is named, and the final table, comparing a straight line with an exponential, is the whole argument in a single picture.
- “A secret in plain sight” closes the cryptography block with Diffie–Hellman live: the student plays Ana against the engine and decrypts a message; the whole class can try to play the eavesdropper.
Room-by-room contents
Room 1 · The shape of the curve
Why these curves matter (https, WhatsApp, Bitcoin, Fermat’s Last Theorem) and a bit of history. How to draw y² = x³ + ax + b, step by step with y² = x³ − 4x: where x³ + ax + b is negative there is no curve, and where it is positive there are two symmetric points. Then two sliders: the curve is symmetric about the x-axis and has one piece or two depending on the real roots of x³ + ax + b.
Student tasks
- With b = 0, for which values of a there are two pieces (a < 0).
- With a = −2, move b until the egg separates from the branch (discovery).
- Which condition on a and b gives two pieces (4a³ + 27b² < 0).
Room 2 · Nodes and cusps
When the egg touches the branch a node appears; with a = b = 0, a cusp. Worked example: y² = x³ − 12x + 16 = (x − 2)²(x + 4) has a node at (2, 0) with two tangents. Criterion: 4a³ + 27b² = 0. Singular curves are not elliptic.
Student tasks
- The value of a that makes y² = x³ + ax + 16 singular (−12).
- How many pieces y² = x³ − 3x + b has with b = 1.9 and with b = 2.1 (two and one).
- Where the node of y² = x³ − 3x + 2 is ((1, 0)).
Room 3 · Lines that cut
Substituting y = mx + c into the curve leaves an equation of degree 3: worked example with y = x + 1 and y² = x³ + 1, which meet at (−1, 0), (0, 1) and (2, 3). Then a line is dragged and intersections are counted: 3 (counting tangencies twice), or 2 + “one at infinity” if vertical.
Student tasks
- Place the line tangent to the curve.
- On y² = x³ − 3x + 6, the other intersection of the horizontal tangent y = 2 at (1, 2) ((−2, 2)).
- Whether a non-vertical line can miss the curve altogether (no).
Room 4 · Diophantus’ problem
Rational points, Diophantus and Bachet. Worked example: the tangent to y² = x³ + 17 at (−1, 4) gives the rational point (137/64, 2651/512). Then Bachet’s curve, y² = x³ − 2, with (3, 5): the tangent at (3, 5) gives another rational point, (129/100, 383/1000) (Bachet, 1621), and by symmetry (129/100, −383/1000).
Student tasks
- The slope of the tangent at (3, 5) (27/10).
- The denominator of the new x (100).
- The value of that x (129/100).
Room 5 · The third point
P ∗ Q: the line through P and Q meets the curve again at a third point. Worked example on y² = x³ + 17 with P = (−2, 3) and Q = (−1, 4): slope 1, x₃ = m² − x₁ − x₂ = 4 and P ∗ Q = (4, 9), with no square roots involved.
Student tasks
- Drag to the third point of (2, 5) and (4, 9) ((−2, −3)).
- Without any working, what (2, 5) ∗ (−2, −3) is ((4, 9): three collinear points swap roles).
Room 6 · Adding means reflecting
Why reflect? If P + Q were the third point, there would be no identity element. Definition: P + Q = reflection of P ∗ Q. Worked example: (2, 5) + (8, 23) = (−1, 4).
Student tasks
- (−2, 3) + (−1, 4) in parts: slope, x₃, y₃ and reflection ((4, −9)).
- The other way round: with P = (−2, 3) and P + Q = (4, −9), find Q ((−1, 4)).
Room 7 · The point at infinity
The point O: animated projective view. P + (−P) = O and P + O = P.
Student tasks
- What is (2, 5) + (2, −5) (O).
- What is −(4, 9).
Room 8 · Adding a point to itself
P + P: the chord turns into the tangent as Q slides toward P (sliding animation). Slope of the tangent: m = (3x² + a)/(2y). Worked example with P = (−1, 4) on y² = x³ + 17: 2P = (137/64, −2651/512).
Student tasks
- On y² = x³ + 5x − 2, compute 2·(1, 2) in parts: m = 2, x₃ = 2, y₃ = 4 and reflection ((2, −4)).
- Why 2P = O when y = 0 (vertical tangent).
Room 9 · An addition you can regroup
Experiment: drag P, Q, R and watch (P + Q) + R and P + (Q + R) built at the same time; they always match, even though it is far from obvious (the nine points of Cayley–Bacharach). Commutative: the line through P, Q is the same as through Q, P.
Student tasks
- Predict before releasing, and multiple choice on which property has been seen.
- With P = (−2, 3) and Q = (4, 9) fixed, find R such that P + Q + R = O ((−1, 4)).
Room 10 · Multiplying a point
n·P = P + P + …; the orbit of (3, 5) on y² = x³ − 2 jumps around the whole curve without repeating (infinite order). Double and add with the binary digits of n: 13 = 1101₂ ⇒ double, add, double, double, add (5 operations instead of 12).
Student tasks
- Among n = 1 to 100, which needs the most operations with double and add (95 = 1011111₂: 6 doublings + 5 additions = 11).
- Build 5·P with the fewest steps (2 doublings + 1 addition).
Room 11 · The point hunter
Rationals ⇒ rationals: m, x₃ and y₃ are computed only with sums, differences, products and quotients. Height of a point (m/d², k/d³). By hand on y² = x³ + 17: x = −1, −2 and 2 give perfect squares; x = 1 does not. Then the automatic search: the student fixes a bound H and the engine scans every d and m; the points found light up on the curve and in the list.
Student tasks
- Propose an integer x, other than −1, with x³ + 17 a perfect square (the engine answers every try).
- With H = 4, find the point with a denominator ((1/4, 33/8)).
Room 12 · Everything comes from a few
Mordell’s theorem (1922): all rational points are obtained by adding and subtracting a few generators; E(Q) ≅ T ⊕ Z^r, with r the rank. On y² = x³ + 17, with G₁ = (−2, 3), G₂ = (2, 5) and the buttons ±G₁, ±G₂ and double, points are built using the rule “three collinear points add up to O”.
Student tasks
- Build (4, 9) (= G₁ − G₂).
- Build (−1, 4) (= G₂ − 2G₁), recognizing the third intersection among the marked points.
Room 13 · Digits that explode
Graph of the denominator digits of n·(3, 5): 1, 3, 5, 8, 15, 21, 28, 37, 48, 59 (n = 1…10). Grows like n² (overlaid parabola).
Student tasks
- Predict how many digits the denominator of 20·P will have (≈ 4 × 59; an answer in range, 200 to 270).
- With the quadratic law, the smallest n whose denominator exceeds 1000 digits (42).
Room 14 · Congruent numbers
n is congruent if it is the area of a right triangle with rational sides (6 with 3-4-5; 5 with 3/2, 20/3 and 41/6). Fermat’s argument animated step by step: from 3-4-5, two squares lead to three rational squares in a row and to the point (25/4, 35/8) on y² = x³ − 36x. Formulas back: a = |x² − n²|/|y|, b = |2nx|/|y|, c = (x² + n²)/|y|. Doubling the point turns the triangle into another one with the same area (7/10, 120/7, 1201/70). Closes with 157 (Zagier).
Student tasks
- The point (−4, 6) with n = 5 → legs and hypotenuse of the triangle (3/2, 20/3, 41/6).
- The point of y² = x³ − 576x that corresponds to the 6-8-10 triangle ((25, ±35)).
Room 15 · Points of order 2
2P = O ⇔ y = 0. y² = x³ − x has three: (−1, 0), (0, 0), (1, 0) → together with O, Z/2 × Z/2.
Student tasks
- How many points of order 2 do y² = x³ + 1 (1) and y² = x³ + 17 (0) have.
Room 16 · Inflection points
3P = O ⇔ P is an inflection point (the tangent meets the curve 3 times at P). Animation of the tangent “flattening”. On y² = x³ + 1, (0, ±1). The orbit of a point of order n closes after n steps; that of a point of infinite order, such as (3, 5) on Bachet’s curve, never comes back.
Student tasks
- Find by dragging an inflection point of y² = x³ − 9x + 9 ((3, ±3)).
Room 17 · The Nagell–Lutz filter
Torsion has integer coordinates and y = 0 or y² | 4a³ + 27b²: a necessary condition, not a sufficient one. Worked example with y² = x³ + 1 (4a³ + 27b² = 27, y ∈ {0, ±1, ±3}): five candidates, all of them torsion, which together with O form Z/6.
Student tasks
- On y² = x³ + 9, mark which of the four points passing the filter are torsion, watching their orbits ((0, ±3); (−2, ±1) have infinite order).
- How many values of y > 0 pass the filter on y² = x³ − 2 (4, and none gives an integer x).
- What can be said about (3, 5) on y² = x³ − 2 without adding anything (it is not torsion: 25 does not divide 108).
- On y² = x³ + 17, compute 2·(−2, 3) = (8, −23) and deduce that (−2, 3) has infinite order even though it passes the filter.
Room 18 · Families with torsion
Tate normal form, y² + (1 − c)xy − by = x³ − bx², with P = (0, 0). The order n is chosen with buttons and a slider u deforms the curve, but the polygon of the orbit of P still has n sides.
Student tasks
- With n = 12, the order of 3P (4).
- With n = 10, which multiple kP has order 2 (5P).
- With n = 9, how many of P, 2P, …, 8P have order 9 (6).
Room 19 · Mazur’s museum
Museum of the 15 possible torsion groups over Q: Z/n (n = 1…10, 12) and Z/2 × Z/2m (m = 1…4). A display case with one curve for each and its orbit.
Student tasks
- Which pair of orders two points of the same curve cannot have (3 and 5: their sum would have order 15).
- The torsion group of a curve with three points of order 2 and one of order 3 (Z/2 × Z/6).
Room 20 · The curve modulo p
Where it is used (https, WhatsApp, Bitcoin) and why curves: a 256-bit curve protects as much as a modulus of over 3000 bits. The same equation, with arithmetic modulo a prime p: the curve becomes a symmetric cloud of points on a grid (animation: p grows). Hasse: |#E − (p + 1)| ≤ 2√p. Torsion survives (6 divides #E for y² = x³ + 1).
Student tasks
- Find by hand the points of y² = x³ + 1 mod 5 with the table of squares (6, with O).
- By the Hasse bound, the most points a curve mod 101 can have (122).
Room 21 · Adding modulo p
Addition works the same way: the line wraps around the edges of the grid (as on a torus) and still passes through 3 points. Dividing = multiplying by the inverse mod p (mini inverse calculator). Worked example on y² = x³ + x + 1 mod 23: (9, 16) + (12, 4) = (18, 20).
Student tasks
- G + G for G = (3, 10) mod 23, step by step: m = 6 (the inverse of 20 is 15), x₃ = 7, y₃ = 12.
- With G of order 28, what 27·G is without adding anything ((3, 13)).
Room 22 · Hide and seek
A single question for the whole room: given n·G, can n be found? Round 1, over Q (y² = x³ − 2, P = (3, 5)): the engine hides n between 1 and 20 and, by comparing denominator digits (which grow like n²), it is guessed. A non-scoring illustration in the cloud mod 1009: two neighbouring points can be very different multiples, and two consecutive multiples land in opposite corners. Round 2, the student hides their own n (between 2 and 1012): the engine computes n·G by doubling and adding, then searches for n by brute force with a live counter. It closes with the table of fear: with a k-bit key, the way there ≈ 2k operations, the brute-force way back ≈ 2^k and the best known attack ≈ √(2^k).
Student tasks
- Round 1: guess n using the denominator digits.
- Round 2: hide an n and compare the cost of the way there with the cost of the way back.
- If the denominator of n·P has 130 digits, in which range n lies (between 11 and 15).
- Multiple choice: why getting closer little by little does not help modulo p.
- How many steps on average by brute force if the group has 1013 points (~506).
Room 23 · Baby steps, giant steps
With m = ⌈√N⌉, a list of m babies (0·G, …, (m − 1)·G) and giants Q, Q − mG, Q − 2mG… until one matches a baby. Animation with G = (0, 425) and Q = (337, 940) mod 1009 (1013 points, m = 32). The best known attack brings N steps down to √N. With 256 bits: √(2^256) = 2^128 ≈ 3.4·10^38 steps, at 10^9 per second ≈ 10^22 years (the universe is 1.4·10^10 years old). Honest mention: a large quantum computer (Shor) would break it.
Student tasks
- How many steps the animation needed (32 babies + 24 giants = 56, against 776 by brute force).
- How many years, in order of magnitude (10^22).
Room 24 · A secret in plain sight
Ana publishes a·G, Bruno publishes b·G and both compute ab·G; an eavesdropper who sees G, a·G and b·G would have to solve the inverse problem. Paint-mixing metaphor, animated with colours on the mod 23 board, then the real version with G = (3, 10), of order 28, and the table of its multiples. The student plays Ana and the engine plays Bruno.
Student tasks
- With a = 5 and b = 9, the shared secret (ab mod 28 = 17 and 17·G = (18, 3)).
- Play Ana: choose a secret n, send n·G, compute the secret S with the m·G the engine sends back, and decrypt with k = x(S) a message in a Caesar cipher.
- As the eavesdropper, with which key sizes a could be recovered (5 and 10 bits yes, 256 bits no).
Room 25 · Curve detective
A new random curve (from a verified list): the student uses the Nagell–Lutz filter, orbits and a search for points of small height to give its torsion and a point of infinite order, if there is one.
Student tasks
- Identify the torsion group of the curve.
- Decide whether it has points of infinite order (rank at least 1).
- If it does, write one down.
Room 26 · Curve calculator
Final room, with no tasks and no scoring: choose a curve (or type a and b), see its exact torsion, search for rational points up to a height H, add, subtract, multiply and compute orders and orbits with exact arithmetic, and view it modulo p with the Hasse bound. It stays open to come back to.
Student tasks
- No tasks: freely explore another curve, another point or another prime.
Rooms to project
The most striking ones to show and discuss in class.